Australian Signals Directorate (ASD) chief Rachel Noble said the six-month war had elements the intelligence agency "didn't really see coming".

"Cyber criminals started to take sides in the war," said Ms Noble at foreign policy think-tank the Lowy Institute on Friday.

"These are serious and organised criminal gangs with deep resources, who took it upon themselves to take action both on behalf of Russia and on behalf of Ukraine, and involve themselves in the conflict."

She described how the prominence of non-state illicit actors at the theatre of war had made intelligence gathering a particularly "messy" task.

"It can be very difficult to discern whether it's a state-based actor, a criminal or a criminal operating at the direction of a state-based actor, or just deriving their own intent from that state actor and then undertaking offensive action," she said.

"For organisations like ASD, that makes that whole environment very messy."

Ms Noble, the first woman to head up an Australian intelligence agency, also admitted the inherently secretive nature of intelligence agencies can sometimes hamper their work by fostering mistrust with citizens.

"We've seen terrible moments in history (when) trust is eroded, it can actually remove a mandate for an intelligence agency to operate to its functions," she said.

"I'm thinking here of the Snowden leaks for example."

Former National Security Agency contractor turned whistleblower Edward Snowden leaked classified documents in 2013 that showed an extensive surveillance network spying on US citizens.

"It was a surprise and that had a far greater impact than it might have otherwise had," she said.

Ms Noble said intelligence agencies are now more attuned to being publicly engaged and transparent.

"The NSA like us now are on a journey of getting out there publicly talking about what we do and really trying to help people understand ... what we do, how it works and how we're oversighted".

Australian Associated Press